{"record":{"id":"3ac35a98ca545e89","repo":"coder/code-server","slug":"cert-key-is-missing","errorCode":null,"errorMessage":"--cert-key is missing","messagePattern":"--cert-key is missing","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/node/cli.ts","lineNumber":490,"sourceCode":"          ;(args[key] as string) = value\n          break\n        }\n      }\n\n      continue\n    }\n\n    // Everything else goes into _.\n    if (typeof args._ === \"undefined\") {\n      args._ = []\n    }\n\n    args._.push(arg)\n  }\n\n  // If a cert was provided a key must also be provided.\n  if (args.cert && args.cert.value && !args[\"cert-key\"]) {\n    throw new Error(\"--cert-key is missing\")\n  }\n\n  logger.debug(() => [`parsed ${opts?.configFile ? \"config\" : \"command line\"}`, field(\"args\", redactArgs(args))])\n\n  return args\n}\n\n/**\n * Redact sensitive information from arguments for logging.\n */\nexport const redactArgs = (args: UserProvidedArgs): UserProvidedArgs => {\n  return {\n    ...args,\n    password: args.password ? \"<redacted>\" : undefined,\n    \"hashed-password\": args[\"hashed-password\"] ? \"<redacted>\" : undefined,\n    \"github-auth\": args[\"github-auth\"] ? \"<redacted>\" : undefined,\n  }\n}","sourceCodeStart":472,"sourceCodeEnd":508,"githubUrl":"https://github.com/coder/code-server/blob/51f90a376b42e217b38937410fe2855e0c1db87e/src/node/cli.ts#L472-L508","documentation":"When TLS is enabled with --cert, code-server requires the matching private key via --cert-key (cli.ts:490). A certificate alone cannot complete a TLS handshake, so the startup is aborted before binding the HTTPS listener.","triggerScenarios":"Launching `code-server --cert=/etc/ssl/server.crt` without also passing `--cert-key=...`, or passing an empty/undefined cert-key value.","commonSituations":"Setting up HTTPS with a Let's Encrypt cert and forgetting the .key path; reversing the two flags so cert-key is omitted.","solutions":["Provide the key alongside the cert: `code-server --cert=server.crt --cert-key=server.key`","Verify both file paths exist and are readable by the code-server user","If you only have a combined PEM, split it into separate cert and key files"],"exampleFix":"# before\ncode-server --cert=/etc/ssl/server.crt\n\n# after\ncode-server --cert=/etc/ssl/server.crt --cert-key=/etc/ssl/server.key","handlingStrategy":"validation","validationCode":"function validateTlsArgs(args: { cert?: string; \"cert-key\"?: string }): void {\n  if (args.cert && !args[\"cert-key\"]) {\n    throw new Error(\"--cert requires --cert-key\")\n  }\n  if (args.cert && !fs.existsSync(args.cert)) throw new Error(`cert not found: ${args.cert}`)\n  if (args[\"cert-key\"] && !fs.existsSync(args[\"cert-key\"])) {\n    throw new Error(`cert-key not found: ${args[\"cert-key\"]}`)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always provision cert and key as a pair","Use a config file for TLS so both paths live together","Add a pre-start readiness check that both files are readable"],"tags":["tls","cli","configuration","security","https"],"backgroundTag":null,"analyzedSha":"51f90a376b42e217b38937410fe2855e0c1db87e","analyzedAt":"2026-08-12T11:27:34.273Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}